From a4154fc4a8149d34d6c5faba9a6b8f33e2ca7e3f Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Wed, 4 Nov 2026 23:32:09 +0100 Subject: [PATCH] test(agentic-engineering): pin the bundled GitHub servers' limits github's exclusion list is the only thing keeping its merge, repository, file-write and workflow tools away, and a probe cannot stand in for it: GitHub offers delete_repository only to clients speaking MCP 2026-07-28 with elicitation. Make the headers helper's self-test fail if any excluded tool leaves the list, or if github-ghas-tools loses its read-only URL, header or toolsets, with negative controls for both. Explain the mechanism in the README. Co-Authored-By: Claude Opus 5.5 --- .claude-plugin/marketplace.json | 2 +- .github/plugin/marketplace.json | 2 +- .../.claude-plugin/plugin.json | 2 +- .../.codex-plugin/plugin.json | 2 +- plugins/agentic-engineering/CHANGELOG.md | 8 +++++ plugins/agentic-engineering/README.md | 7 +++-- plugins/agentic-engineering/plugin.json | 2 +- .../scripts/github-mcp-headers.test.sh | 30 +++++++++++++++++++ 8 files changed, 47 insertions(+), 8 deletions(-) diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index 41771c0..ea519f2 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -20,7 +20,7 @@ { "name": "agentic-engineering", "description": "The autonomous engineering system for repository portfolios and everything its agents need — engineer, read-only surveyor, meta-engineer and Flux troubleshooter agents; portfolio, product, spend and improvement workflows; GitHub, CodeRabbit review, security, library documentation, Go, Kubernetes, Flux, Talos, SvelteKit frontend, Stripe payments, engineering-practice, design, product-management, marketing, finance and productivity skills; and the MCP servers they use; configured by the consumer AGENTS.md", - "version": "7.1.0", + "version": "7.1.1", "source": "./plugins/agentic-engineering" }, { diff --git a/.github/plugin/marketplace.json b/.github/plugin/marketplace.json index 41771c0..ea519f2 100644 --- a/.github/plugin/marketplace.json +++ b/.github/plugin/marketplace.json @@ -20,7 +20,7 @@ { "name": "agentic-engineering", "description": "The autonomous engineering system for repository portfolios and everything its agents need — engineer, read-only surveyor, meta-engineer and Flux troubleshooter agents; portfolio, product, spend and improvement workflows; GitHub, CodeRabbit review, security, library documentation, Go, Kubernetes, Flux, Talos, SvelteKit frontend, Stripe payments, engineering-practice, design, product-management, marketing, finance and productivity skills; and the MCP servers they use; configured by the consumer AGENTS.md", - "version": "7.1.0", + "version": "7.1.1", "source": "./plugins/agentic-engineering" }, { diff --git a/plugins/agentic-engineering/.claude-plugin/plugin.json b/plugins/agentic-engineering/.claude-plugin/plugin.json index d6d27cc..2ea50f1 100644 --- a/plugins/agentic-engineering/.claude-plugin/plugin.json +++ b/plugins/agentic-engineering/.claude-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "agentic-engineering", "description": "The autonomous engineering system for repository portfolios and everything its agents need — engineer, read-only surveyor, meta-engineer and Flux troubleshooter agents; portfolio, product, spend and improvement workflows; GitHub, CodeRabbit review, security, library documentation, Go, Kubernetes, Flux, Talos, SvelteKit frontend, Stripe payments, engineering-practice, design, product-management, marketing, finance and productivity skills; and the MCP servers they use; configured by the consumer AGENTS.md", - "version": "7.1.0", + "version": "7.1.1", "author": { "name": "devantler-tech", "url": "https://github.com/devantler-tech" diff --git a/plugins/agentic-engineering/.codex-plugin/plugin.json b/plugins/agentic-engineering/.codex-plugin/plugin.json index 68c872e..53bbbb0 100644 --- a/plugins/agentic-engineering/.codex-plugin/plugin.json +++ b/plugins/agentic-engineering/.codex-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "agentic-engineering", "description": "The autonomous engineering system for repository portfolios and everything its agents need — engineer, read-only surveyor, meta-engineer and Flux troubleshooter agents; portfolio, product, spend and improvement workflows; GitHub, CodeRabbit review, security, library documentation, Go, Kubernetes, Flux, Talos, SvelteKit frontend, Stripe payments, engineering-practice, design, product-management, marketing, finance and productivity skills; and the MCP servers they use; configured by the consumer AGENTS.md", - "version": "7.1.0", + "version": "7.1.1", "author": { "name": "devantler-tech", "url": "https://github.com/devantler-tech" diff --git a/plugins/agentic-engineering/CHANGELOG.md b/plugins/agentic-engineering/CHANGELOG.md index 313f41c..090b708 100644 --- a/plugins/agentic-engineering/CHANGELOG.md +++ b/plugins/agentic-engineering/CHANGELOG.md @@ -1,5 +1,13 @@ # Changelog — `agentic-engineering` +## 7.1.1 — 2026-11-04 + +**Fixed** — the README now says why `github` excludes `delete_repository` although a plain probe +never lists it: GitHub offers it only to clients that speak MCP protocol 2026-07-28 and declare +elicitation, as Claude Code 2.1.317 does. A self-test now fails if any excluded tool leaves +`github`'s list, or if `github-ghas-tools` loses its read-only endpoint, its read-only header or +its toolsets. + ## 7.1.0 — 2026-11-04 The plugin now carries the agents' wider workspace: design, product management, marketing, diff --git a/plugins/agentic-engineering/README.md b/plugins/agentic-engineering/README.md index 2e8234d..ff6a46d 100644 --- a/plugins/agentic-engineering/README.md +++ b/plugins/agentic-engineering/README.md @@ -269,9 +269,10 @@ pull request branch, create, fork or delete repositories, write files and run wo `merge_pull_request`, `update_pull_request`, `pull_request_review_write`, `add_comment_to_pending_review`, `update_pull_request_branch`, `create_repository`, `fork_repository`, `delete_repository`, `push_files`, `create_or_update_file`, `delete_file` and -`actions_run_trigger`. GitHub does not offer every tool to every connection: a Claude Code -session received `delete_repository` although direct probes of the same toolsets did not, so the -list names it anyway. +`actions_run_trigger`. GitHub does not offer every tool to every client: it offers +`delete_repository` only to clients that speak MCP protocol 2026-07-28 and declare elicitation, as +Claude Code 2.1.317 does, so an older probe never sees it. The list names it anyway, and a test +keeps every name on it. Do those through `gh` and git, where a consumer's merge, readiness, review, signing and repository rules apply. What stays can still write as the signed-in account: issues and sub-issues (including closing them), labels (including deleting them), comments and replies, branches, new pull requests diff --git a/plugins/agentic-engineering/plugin.json b/plugins/agentic-engineering/plugin.json index d6d27cc..2ea50f1 100644 --- a/plugins/agentic-engineering/plugin.json +++ b/plugins/agentic-engineering/plugin.json @@ -1,7 +1,7 @@ { "name": "agentic-engineering", "description": "The autonomous engineering system for repository portfolios and everything its agents need — engineer, read-only surveyor, meta-engineer and Flux troubleshooter agents; portfolio, product, spend and improvement workflows; GitHub, CodeRabbit review, security, library documentation, Go, Kubernetes, Flux, Talos, SvelteKit frontend, Stripe payments, engineering-practice, design, product-management, marketing, finance and productivity skills; and the MCP servers they use; configured by the consumer AGENTS.md", - "version": "7.1.0", + "version": "7.1.1", "author": { "name": "devantler-tech", "url": "https://github.com/devantler-tech" diff --git a/plugins/agentic-engineering/scripts/github-mcp-headers.test.sh b/plugins/agentic-engineering/scripts/github-mcp-headers.test.sh index 09187c6..3ed0122 100755 --- a/plugins/agentic-engineering/scripts/github-mcp-headers.test.sh +++ b/plugins/agentic-engineering/scripts/github-mcp-headers.test.sh @@ -123,4 +123,34 @@ fi run 2 "$work/data" extra -- PATH="$work/bin" STUB_TOKEN=gho_cliToken123 [ ! -s "$work/out" ] || fail "printed output for a usage error" +# 11. The two servers this helper signs in keep their limits. github's exclusions remove the +# tools that bypass a consumer's command-line rules; GitHub offers some of them only to some +# clients (delete_repository needs MCP 2026-07-28 with elicitation), so a probe cannot stand in +# for this list. github-ghas-tools stays read-only on its own URL, which Claude Code needs to +# load both servers. +servers_keep_limits() { # mcp-json + jq -e ' + def excluded: (.mcpServers.github.headers["X-MCP-Exclude-Tools"] // "") | split(","); + ["merge_pull_request", "update_pull_request", "pull_request_review_write", + "add_comment_to_pending_review", "update_pull_request_branch", "create_repository", + "fork_repository", "delete_repository", "push_files", "create_or_update_file", + "delete_file", "actions_run_trigger"] - excluded == [] and + .mcpServers.github.url == "https://api.githubcopilot.com/mcp/" and + .mcpServers["github-ghas-tools"].url == "https://api.githubcopilot.com/mcp/readonly" and + .mcpServers["github-ghas-tools"].headers["X-MCP-Readonly"] == "true" and + .mcpServers["github-ghas-tools"].headers["X-MCP-Toolsets"] == + "code_security,secret_protection,security_advisories,dependabot" and + ([.mcpServers.github.headersHelper, .mcpServers["github-ghas-tools"].headersHelper] | + all(. == "bash \"${CLAUDE_PLUGIN_ROOT}/scripts/github-mcp-headers.sh\" \"${CLAUDE_PLUGIN_DATA}\"")) + ' "$1" > /dev/null +} +mcp_json="$here/../.mcp.json" +servers_keep_limits "$mcp_json" || fail "the bundled GitHub servers lost a limit in .mcp.json" +jq '.mcpServers.github.headers["X-MCP-Exclude-Tools"] |= (split(",") - ["delete_repository"] | join(","))' \ + "$mcp_json" > "$work/fewer-exclusions.json" +if servers_keep_limits "$work/fewer-exclusions.json"; then fail "accepted github without delete_repository excluded"; fi +jq '.mcpServers["github-ghas-tools"].url = "https://api.githubcopilot.com/mcp/"' \ + "$mcp_json" > "$work/shared-url.json" +if servers_keep_limits "$work/shared-url.json"; then fail "accepted github-ghas-tools on github's URL"; fi + printf 'github-mcp-headers: PASS\n'